The invention relates to an Internet security system. The growth of the Internet and high-traffic web sites that require high performance and high bandwidth networks have resulted in an increased number of so-called service providers, including Internet data centers, application service and security service providers. A service provider, including an Internet data center, provides network resources, one or more dedicated servers and, in some cases, physical space, to host services for a number of customers, usually for a fee. Conventionally, service providers must install and configure one or more dedicated servers to support each customer and will likely require complex networks to manage separate services for the service provider's customer base. In this environment, the customer typically has some administrative control of the servers and control of the content residing on the servers. An Internet data center typically provides the network, network access, hardware, software and infrastructure needed to power the service, including web site, managed security, and so on.
An exemplary view of the organization of a conventional Internet data center is shown in FIG. 1. In the present example, the Internet data center (100) has a number of customers A, B, C, D. The Internet data center (100) shown in FIG. 1 is set up for four customers only, while in reality a data center may host hundreds or potentially thousands of users. Each customer has one or more dedicated servers (105), a dedicated firewall (110) and one or more switches (115) that are all connected and form a subnet (120) for that particular customer. The subnets (120) are coupled together in the core switch fabric (125), which in turn forms an interface to the Internet.
The conventional model for organizing an Internet data center requires that a separate firewall device be deployed every time a new customer joins the Internet data center, which may require network re-configuration, and be a labor intensive and costly task. In this environment, the staff at the Internet data center must separately configure, upgrade, manage and support each firewall device separately. The conventional way for organizing Internet data centers also requires a heavy need for physical rack space to accommodate the physical installation of separate firewall and other networking devices upon which the provider's services are hosted. As a result of the large amount of separate equipment, the wiring and related switching and routing infrastructure becomes complex. If a firewall fails, it will be costly to repair or replace and the down time the client experiences before his or her firewall has been repaired or replaced may be considerable. The down time can be reduced if redundant boxes are provided, but this solution leads in turn to increased cost, space, maintenance and wiring problems, and is therefore not a desirable solution.